fix possible double free in expand()